CYC Public Health City of York Council Internal Audit Report 2016/17

Business Unit: Public Health Responsible Officer: Director of Public Health Date Issued: 31 May 2017 Status: Final Reference: 10845/007

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Reasonable Assurance | Summary and Overall Conclusions

Introduction Public Health responsibilities transferred from the NHS to local government on 1 April 2013. The council and Director of Public Health have statutory responsibility to provide mandated services which include:

- Taking steps to protect the health of the population
- Providing advice to NHS commissioners
- Sexual health and contraception services
- the National Child Measurement Programme
- NHS Health Check Assessments
- the national 0-5 Healthy Child Programme

As well as these mandated services, others are discretionary and are guided by the Public Health Outcomes Framework, the local Joint Strategic Needs Assessment (JSNA) and the Joint Health and Wellbeing Strategy (JHWS). The JSNA and JHWS are produced by the Health and Wellbeing Board (HWB), which brings together relevant local organisations. The Health and Wellbeing board is chaired by the Executive Member for Adult Social Care and Health and the Director of Public Health chairs the Joint Strategic Needs Assessment and Joint Health and Wellbeing Strategy Sub-group of the Board.

The council received £8.63m of funding from the Department of Health in 2015-16 and £8.43m in 2016-17.

Objectives and Scope of the Audit The 2014-15 audit of Public Health gave an opinion of ‘Limited Assurance’ and a number of actions were agreed to address the issues found. This audit followed up actions taken to address issues identified in the previous audit report, in order to confirm that actions have been completed.

In addition, the areas outlined below were reviewed in order to provide assurance to management that procedures and controls within the system ensure that:

- sound systems are in place to develop and implement Public Health contracts, including performance management of contracts;
- performance monitoring takes place against public health outcomes and action is taken as appropriate;
- a Public Health budget is produced in line with financial procedure and on a sound basis and effective in year budget monitoring takes place. Key Findings

There have been significant improvements within the council's public health service since the last audit was undertaken. There is now a full time Director of Public Health (DPH) who reports to the Corporate Director of Health, Housing and Adult Social Care and is accountable to the Chief Executive for delivery of statutory public health functions. The Director is a member of the council's senior leadership team and other senior posts have also been recruited into. This has provided stability and leadership for the service.

The procedures in place for contract management are more robust. A contract register is in place and the public health team work with the council's procurement section to plan future procurement activity. Regular contract performance information is reviewed and meetings are held with contractors and minuted. Some improvements could be made to the quality of the minutes and in identifying when any actions are required by the council or contractor. Staff have received training in contract management and seek and receive the support of the council's procurement team.

Although contract management procedures are much improved there are areas that require addressing. Contracts are not formally risk assessed, with the result that supplier performance measures and contract management arrangements may not meet the council's requirements and be proportionate to the contract risks. In addition, there are no routine formal reviews of contracts or quality checks undertaken on the actual delivery of services.

Performance indicators have been established for public health and a scorecard produced based on priority areas for the city. The scorecard indicators are reported alongside the national position as a benchmark and have a RAG rating and direction of travel to aid interpretation. The scorecard is reviewed monthly by the public health management team and reported quarterly to CMT, Executive and Scrutiny committee.

The public health budget is formulated and approved appropriately. It is still largely based on the previous year’s budget and identification of the level of savings required. There is clear responsibility for producing and monitoring the budget and it is regularly reviewed and reported by the service, with support from finance officers. Contributions are made from the ring fenced public health grant to other council services (for example, air quality work and adult social care preventative services) as part of the overall budget setting process and these are focused on improving population health outcomes.

Overall Conclusions

The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 1 Contract Management - Formal procedures and risk management

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | Contracts risks are not formally assessed and contract management procedures are not proactively based on the council’s requirements. | Contract management may not be effective and may also be inefficient if all contracts are managed in the same way, rather than based on an assessment of risk. |

Findings

Overall, contract management has improved since they were previously audited. A contract register is in place, all contracts have an assigned contract manager and regular meetings with suppliers are minuted. The staff within the service have received training from the corporate procurement team and contracts themselves contain details of how each contract will be managed, including performance measures for each contract and details on the frequency of meetings with the suppliers.

However, there is still some scope for further improvement. The service does not have formal contract management procedures and some staff were unaware of the council’s contract management guidance. In particular, there is no formal process for identifying and assessing contract risks, with the result that contract management processes may not be effective or proportionate.

Responses from the service indicated that any assessment of contract risks happens on a reactive basis. Ideally contract management procedures would be based on an assessment of risks (e.g. value of contract, new services, past performance of supplier, customer feedback), with those assessed as higher risk having more frequent and/or in depth monitoring.

Agreed Action 1.1

Risks will be identified and assessed for each contract / service. This risk assessment will be used to determine the contract monitoring arrangements for each contract / service.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Director of Public Health | June 2017 | 2 Contract Management - Minuting Outcomes and Actions from supplier meetings

| Issue/Control Weakness | Risk | |------------------------|------| | Minutes of meetings with suppliers do not clearly identify what the outcomes and any actions arising from the meetings are. | Contract performance issues may not be addressed or followed up and lack of detail in minutes may result in lack of rigour and in level of assurance management has regarding effective contract management. |

Findings

Overall, contract management procedures have improved since they were previously audited. Regular meetings take place and are now minuted to show what was discussed and there was evidence that contract performance information was being received and reviewed at these meetings.

However, minutes of these meetings do not always contain enough detail to show what was discussed and to give assurance that contract management is thorough and ensures that services are being delivered to the expected standard and opportunities for improvement are identified.

In particular, the outcomes and any actions arising from the meetings are not clearly identified and recorded in the minutes so it was not always possible to see that actions have been agreed where required or followed up on in subsequent meetings. There were some good examples of minutes, with sufficient detail and clearly allocated actions, but these were infrequent.

Agreed Action 2.1

A standard operating procedure and tracker will be produced for contract monitoring. It will be ensured that contract meetings will be preceded by queries logs and followed up by action plans, which will be reviewed in subsequent meetings.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Director of Public Health | June 2017 | 3 Contract Management - Formal reviews of contracts

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | No formal and detailed reviews of contracts are undertaken during the life of the contract. | Issues with the quality or value for money of a contract may not be identified during the life of the contract. |

Findings

Regular meetings do take place with the suppliers to monitor contract performance. However, these are conducted on an ongoing quarterly basis and do not provide evidence of detailed review of all aspects of the contract. There are no procedures in place for a more formal, periodic and detailed review of contracts.

This could include site visits or quality checks on the delivery of the service and assessments of the value for money of individual contracts. It is recognised that this would not be suitable for all types of contract but for some large contracts for delivery of complex services this would provide greater assurance that the contract is delivering the required service quality, outcomes and value for money for the council.

Agreed Action 3.1

A quality assurance process will be developed and agreed by the public health management team. This will include case study, audit, complaints and compliments and value for money assessment. The extent of and frequency of quality assurance for each contract/service will be influenced by the risk assessment process.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Director of Public Health | June 2017 | 4 Backing data for GUM cross-charging

| Issue/Control Weakness | Risk | |------------------------|------| | Information to support the payment of invoices for GUM cross-charging is not retained. | Insufficient audit trail and inability to check supporting data in the event of queries over invoices paid. |

Findings

The public health team pays invoices for genito-urinary (GUM) services delivered to council residents outside of the council’s boundary. An agreement was reached by the Regional Directors of Public Health Network for Yorkshire and Humber on minimum information requirements for invoicing for these services. The minimum requirements in respect of the invoices themselves were met in all cases tested.

However, the requirements of the regional policy also specifies supporting data that must be included to support the invoices, including LA code, partial postcode, attendance type, treatment type, appointment date, tariff. This data is checked by the public health team before processing invoices for payment but this could not be checked during the audit as it is not retained by the team once the purchase order and invoice are authorised for payment.

The supporting data is the record that supports the invoice amount and confirms that invoices are only being paid for services that the council is responsible for so should be retained for a more complete audit trail and in the event of any queries about invoices that have been paid.

Agreed Action 4.1

Backing data for GUM cross-charging will be retained to the end of the current financial year plus one further year.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Public Health Specialist Practitioner Advanced | Implemented | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |-----------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.